Stage 42 — API Security Audit Trail
Adds a lightweight server-side JSON-lines audit trail for authenticated API requests and unauthorized API attempts. No database schema changes. Audit entries avoid passwords and raw IP addresses; the IP is stored only as a SHA-256 hash.
